Vulnerability Details : CVE-2010-0397
The xmlrpc extension in PHP 5.3.1 does not properly handle a missing methodName element in the first argument to the xmlrpc_decode_request function, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) and possibly have unspecified other impact via a crafted argument.
Vulnerability category: Memory CorruptionDenial of service
Threat overview for CVE-2010-0397
Top countries where our scanners detected CVE-2010-0397
Top open port discovered on systems with this issue
685
IPs affected by CVE-2010-0397 1,439
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2010-0397!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2010-0397
Probability of exploitation activity in the next 30 days: 2.61%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 90 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2010-0397
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST |
Vendor statements for CVE-2010-0397
-
Red Hat 2010-03-22Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-0397 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw.
-
http://www.redhat.com/support/errata/RHSA-2010-0919.html
Support
-
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
[security-announce] SUSE Security Summary Report: SUSE-SR:2010:013
-
http://www.openwall.com/lists/oss-security/2010/03/12/5
oss-security - CVE-2010-0397: NULL pointer dereference in PHP's xmlrpc extensionExploit
-
http://www.mandriva.com/security/advisories?name=MDVSA-2010:068
mandriva.com
-
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
Apple - Lists.apple.com
-
http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html
[security-announce] SUSE Security Summary Report: SUSE-SR:2010:012
-
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=573573
#573573 - CVE-2010-0397: null pointer dereference in the xmlrpc extension - Debian Bug report logsExploit
-
http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html
Apple - Lists.apple.com
-
http://support.apple.com/kb/HT4435
We're sorry.
-
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
[security-announce] SUSE Security Summary Report: SUSE-SR:2010:017
-
http://support.apple.com/kb/HT4312
About Security Update 2010-005 - Apple Support
-
http://www.securityfocus.com/bid/38708
PHP xmlrpc Extension Multiple Remote Denial of Service VulnerabilitiesExploit
-
http://www.vupen.com/english/advisories/2010/3081
Webmail | OVH- OVH
-
http://www.vupen.com/english/advisories/2010/0724
Webmail | OVH- OVH
- cpe:2.3:a:php:php:5.3.1:*:*:*:*:*:*:*